Use native TLS when certificate validation is disabled#425
Use native TLS when certificate validation is disabled#425
Conversation
…ver compatibility When "Validate TLS certificates" is disabled, use the OS native TLS stack (Secure Transport/SChannel/OpenSSL) instead of rustls. This adds support for TLS 1.0+ connections to legacy servers like IBM WebSphere, which rustls cannot handle since it only implements TLS 1.2+. Ref: https://yaak.app/feedback/posts/tls-handshake-eof-when-connecting-to-private-ibm-websphere-endpoint-works-when-s Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 67cbb06bb9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if !crt_path.is_empty() && !key_path.is_empty() { | ||
| let crt_data = std::fs::read(crt_path)?; | ||
| let key_data = std::fs::read(key_path)?; | ||
| let identity = native_tls::Identity::from_pkcs8(&crt_data, &key_data)?; |
There was a problem hiding this comment.
The new validate_certificates == false flow loads CRT+KEY identities with native_tls::Identity::from_pkcs8, which only accepts PKCS#8 keys and rejects common BEGIN RSA PRIVATE KEY (PKCS#1) files; before this change, the same path went through yaak_tls::load_private_key and accepted PKCS#1/PKCS#8/EC keys. This introduces a regression where mTLS requests now fail for users who disable certificate validation and provide an RSA PEM key that previously worked.
Useful? React with 👍 / 👎.
1 participant
Summary
Ref: https://yaak.app/feedback/posts/tls-handshake-eof-when-connecting-to-private-ibm-websphere-endpoint-works-when-s
Test plan
🤖 Generated with Claude Code